Netherlands implements Cybersecurity Act for healthcare sector

The Netherlands has implemented the Cybersecurity Act, the national translation of the European NIS2 directive, which came into effect on August 15, 2026. This legislation significantly increases cybersecurity requirements for the healthcare sector, establishing it as a legal obligation for the first time. Key mandates include strict reporting timelines—requiring early warnings within 24 hours and formal notifications within 72 hours for serious incidents—as well as director liability and chain responsibility for entire supply networks.

NEN7510, a Dutch information security standard for healthcare based on ISO 27001, plays a central role in compliance. The standard applies not only to healthcare providers but also to IT suppliers, hosting providers, and electronic patient record (EPD) vendors.

Additionally, Z-CERT has been officially designated as the Computer Security Incident Response Team (CSIRT) for the healthcare sector and the medical device manufacturing subsector. Following the completion of legal procedures with the Netherlands Court of Audit, Z-CERT has become a legal entity with a statutory task, providing support to healthcare organizations facing cyber threats and incidents.